What each plan includes, and the work it removes

Below are the four plans and, under each, a table of exactly what it carries: every reader, every ceiling, the term and the price. First, what the price is actually against, because a licence fee compared against nothing is a licence fee that looks expensive.

Two people pay for a data map, and only one of them is counted

The first is the one on the plan. A DPO, a privacy lead, a consultant: they chase the systems down, read what they are given, decide what is personal and what is special category, write the record of processing, and defend it when somebody asks.

The second is not on any plan, and is frequently the larger half. Every question in that process is an interruption for an engineer. Which tables hold personal data. What this service writes to its logs. What that endpoint actually returns. Nobody can answer those from memory, so somebody opens the schema, greps the repository, reads a migration from two years ago, and writes it up for a reader who is not technical. Then does it again for the next question.

That work is real, it is skilled, and it is billed to a sprint rather than to the assessment. It is also the work EVIDENT does directly: it reads the catalogue, the code that maps onto it, what the code logs, and what the APIs expose. The engineer stops producing the answer and starts checking one — which is a different job, takes minutes rather than days, and is the one they are qualified to do.

The cheaper idea, and why it costs more

The reflex, after reading that, is to make the work go away. Point a scanner at the database and take the column names it flags. Or hand the whole thing to a model and ask it which fields are personal data.

Both produce an answer quickly, and neither produces one you can stand behind. A scanner matching names has no idea that orientation on a warehouse table is the direction a shelf faces, and it will report a special category on a geometry table until somebody stops reading its output altogether. A model is worse in a quieter way: ask it twice and it can answer differently, and when it is wrong it is wrong fluently. A confident sentence about a column that does not hold what it says it holds is not a finding. It is a mistake wearing the clothes of one.

This is not a domain where that is survivable. The output is a record of processing activities somebody signs, and a regulator reads. It has to be the same answer on Tuesday as it was on Monday, and every conclusion has to be traceable to the thing that produced it.

So EVIDENT reads with deterministic, versioned rules: the same systems and the same rule version give the same result, every time, and each conclusion names the rule and the version that reached it. Where the evidence does not settle a question, it says so and asks a person — it does not fill the gap with a guess to make the report look complete. A name on its own never establishes a special category. AI is used to explain evidence and draft text for a reader, clearly marked as such; it never creates a fact, never overrides a rule, and never turns a low confidence into a high one.

The person stays in the loop by design, and it costs less than it sounds: they are confirming a proposal with its evidence attached rather than producing an answer from nothing.

And then the release ships

A data map is true on the day it is signed and starts decaying the morning after. A migration adds a column. A service starts logging a field it did not log before. An endpoint returns one more attribute because a front end asked for it. None of those announce themselves, and that is the problem: the document does not change, so nothing tells anybody it has stopped being true.

Which leaves two options, and most organisations take the second without deciding to. Re-do the assessment, paying both halves of the bill again. Or keep using a document that is right about the systems as they were.

EVIDENT runs again instead. It re-reads the systems, and it tells you what moved: what is new, what is unchanged, what changed, what was resolved, what came back, and what needs another look. A field somebody already decided, whose material context has not moved, stays decided and stays out of the queue — so the second assessment is a fraction of the first, and the tenth is smaller again.

That is the whole reason this is a subscription rather than a project fee. You are not buying a document. You are buying the property that the document is still true in March.

Where the parts named below actually are

Because a price list is the worst possible place to find out later that something was aspirational.

• AvailableEvery reader in the tables below. The six database engines, the seven framework and ORM readers, the logging analysis and the two API readers are in the build and run today.
• AvailableThe route from a finding back to its evidence. Every material claim can be asked why it was made and where it came from.
• AvailableA summary of what changed, under a report’s date. A second assessment states what moved and what did not, which is the argument for a subscription rather than a project.
• AvailableWhether the code has moved since the assessment was made. Every project says whether its code has moved since the assessment was made — verified against the repository, not assumed from a date. A check that could not be made says so rather than showing green.
• AvailableReassessing a project on a schedule. Weekly, every few days or monthly, at an hour in the project’s own timezone. The demonstration schedules itself and the scheduler runs it, so the two runs it compares are one a person started and one nobody did.
• PreviewRemediation, verified by a later analysis.
• PreviewA portable evidence package. An archive of the assessment — its conclusions, its evidence, its findings, the decision history and the reports — that opens with no account and verifies against its own index with sha256sum -c. It is in the product and downloads from the reports screen. It stays Preview until a public package of EVIDENT assessing EVIDENT is published for anybody to check.
• PlannedA local agent, for sources the platform cannot reach. Not needed by an air-gapped installation, which sits inside the network with everything it reads.
• PlannedGovernance gates in a pipeline.
• PlannedFramework adapters — GDPR, ISO 27001, ISO 27701, EU AI Act. The evidence they would read is collected already; the adapters that map it are not built.

Available is in the product today. Preview is built and reachable, and still changing shape. Planned is specified and not built — published in advance so it can be judged before it exists.

The four plans

A seat is the right meter for a team assessing their own systems, and the wrong one for an estate. Start on the trial; nothing is held back in it.

Free trial

Free

Every capability available today, one person, thirty days. It ends by itself and nothing is charged.

• Every extension
• 2 projects
• 20 reports
• Ends by itself

Start the trial

Team

€19per person / month

Billed annually

One team assessing systems they own. Priced per person, because that is what grows.

• Relational engines
• Application framework & ORM readers
• Logging analysis
• 10 projects · 10 people

Start with Team

Professional

€790per workspace / month

Billed annually

A consultancy running assessments for several clients, or an organisation with an estate rather than a system. Everyone in the workspace, and the meter is the estate.

• Everything in Team
• OpenAPI & GraphQL analysis
• Unlimited reports and people
• Up to 50 systems / data sources

Talk to us

Enterprise

Annual contractpriced on the estate, not on seats

Where the deployment is the requirement. None of this becomes more valuable because a fourth person signs in, so none of it is sold that way.

• Self-hosted or air-gapped
• SSO, roles and an audit trail
• Offline licence, no egress needed
• Report exports and the HTTP API

Talk to us

Nothing that exists is held back — every capability available today, rather than the roadmap — and no card is asked for. It ends by itself, which is the point: an evaluation that has to be cancelled is a decision somebody has to remember to make, and we would rather you came back than forgot to leave.

Two projects is enough to answer the question this trial exists for — point it at a system you already understand, and see whether what it produces is something you would sign.

Priced per person, because for a team assessing their own systems the number of people is what grows. The databases, the framework and ORM readers and the logging analysis: everything needed to answer where personal data lives in an application and what that application writes about it.

Not the API readers. A team assessing systems they own already knows what their services expose to each other; reading the descriptions matters when you are answering for somebody else’s estate, which is the plan below.

A consultancy running assessments for several clients, or an organisation with an estate rather than a system. Everything in Team, plus the OpenAPI and GraphQL readers, which is what turns "what does this application store" into "what does it hand to somebody else".

Priced per workspace and not per person. A workspace does not become more valuable because a fourth person signs into it — it becomes more valuable because there is more estate underneath it, and the meter should say which of those is being sold. It also means nobody has to ration who may read their own organisation’s assessment.

What a workspace is today, because "several clients" invites the wrong picture. One deployment holds one organisation’s projects, so a consultancy keeps its clients apart by keeping their deployments apart — under one commercial relationship, metered per workspace. Isolating several clients inside a single deployment, with evidence packages per client, is specified and Planned; until it exists this page does not sell it, and what a consultant gets today says the same in the same words.

Self-hosted or air-gapped, your own single sign-on through OIDC, the roles your organisation already defines, and the audit trail. The licence is a signed code verified offline against a public key, so an installation with no route to the internet works exactly like one that has it — that is what makes air-gapped a supported deployment rather than a conversation. The local agent and governance gates in a pipeline are Planned, and are named above as such rather than sold here.

Priced on the estate and on an annual contract. None of this becomes more valuable because a fourth person signs in, so none of it is sold that way. For an on-premise installation the support is on the platform and on getting it running — the network it sits on, who can reach the host and how backups are taken stay yours.

The same in every plan, including the free one

Structure, not rows

The analysis reads schemas, constraints, types and comments, and the code that maps onto them. By default it does not read the records in your tables. Profiling and sampling do, they are off, they are opted into per project, and the report says when they were used.

The code is read, not taken

EVIDENT keeps the conclusion and the reference — the file, the symbol, the line — and not the file. On your own hardware the code is read there and does not leave; hosted by us, the repository reaches the machine the analysis runs on, and what survives it is the same conclusion and reference either way.

Why, and where

Every material claim can be asked why it was made and where it came from, and the answer separates what was observed from what was inferred, what a person confirmed from what the platform decided, and what your organisation stated from what nothing corroborated.

What it will not say

There is no compliance score and no certification. The vocabulary is Evidence Coverage, "relevant to" and "requires human review", and it is that way on purpose: a number that flattens a judgement is a number somebody will be asked to defend.

Both languages

The interface, report views and this site are written in English and Spanish, and neither is a machine translation of the other. Exported documents currently use English as their document language.

Questions people ask before buying